- Add 12s timeout to restoreSession() — client.init() could hang
indefinitely if token expired or server unreachable, leaving user
on spinner forever. Now clears stale credentials and shows login.
- Sync persistence startup wrapped in try-catch — non-fatal
- .htaccess blocks .git directory (was returning 200 to scanners)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>